OWASP Top 10
Also known as: OWASP, Open Web Application Security Project, OWASP 2021, web application security risks
The OWASP Top 10 is a consensus-based list of the ten most critical security risks facing web applications, published by the Open Worldwide Application Security Project (called the Open Web Application Security Project until 2023): a nonprofit foundation dedicated to improving software security.
It is not a compliance standard or a checklist but a risk awareness document intended to inform developers, architects, and security teams about where web applications most commonly fail. The 2025 edition, announced in November 2025, is the current version, with categories such as Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, and Injection.
OWASP Top 10, explained at three levels
At home
The OWASP Top 10 is a published list of the ten most common ways websites and apps get hacked. Think of it as the ten most dangerous doors attackers try to open: things like broken login systems that let attackers guess passwords easily, misconfigured servers that expose sensitive data, and outdated software components with known vulnerabilities. Web developers use this list as a guide to the security problems they are most likely to face.
At work
The OWASP Top 10 is the most referenced web application security document in the industry. Many organizations use it as a minimum baseline for secure development: developers are trained to recognize and avoid the listed categories, code reviews check for their presence, and penetration tests specifically probe for them. The current 2025 edition is led by Broken Access Control, Security Misconfiguration, and the new Software Supply Chain Failures category, followed by Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Security Logging and Alerting Failures, and the new Mishandling of Exceptional Conditions.
At home
The 2025 list in brief: A01 Broken Access Control (users reaching data or functions they should not, now including SSRF); A02 Security Misconfiguration; A03 Software Supply Chain Failures (compromised or outdated dependencies and build tools); A04 Cryptographic Failures; A05 Injection (input run as commands); A06 Insecure Design; A07 Authentication Failures; A08 Software or Data Integrity Failures (unverified updates and data); A09 Security Logging and Alerting Failures (attacks going unnoticed); A10 Mishandling of Exceptional Conditions (errors that fail open or leak details). Each category groups many specific weaknesses (CWEs), ranked using breach data and a community survey.
At work
Broken Access Control took first place in 2021 and kept it in 2025, because access rules are application logic: frameworks now block most SQL injection through parameterized queries and ORMs, but no tool knows that user 41 should not see invoice 42. The 2025 edition folded SSRF into access control, since tricking a server into fetching internal URLs is another way of reaching what you should not. It also added Software Supply Chain Failures in third place, reflecting attacks through compromised packages and build pipelines.
At home
OWASP also maintains related projects: the OWASP ASVS (Application Security Verification Standard) provides detailed security requirements at three verification levels; the OWASP Testing Guide provides step-by-step testing procedures; and the Cheat Sheet Series covers specific mitigations for each Top 10 category. The OWASP Top 10 for Large Language Model Applications (2023) extends the concept to AI systems.
At work
From a practitioner standpoint, the most actionable use of the OWASP Top 10 is embedding it into the software development lifecycle rather than treating it as a post-release audit checklist. Threat modelling during design should map proposed data flows against A01 (access control), A04 (cryptography), and A06 (insecure design). Static analysis and dependency scanning tools can automatically detect much of A05 (injection) and A03 (vulnerable supply chain components). The combination of automated detection for technical vulnerabilities and design-time threat modelling for logical vulnerabilities covers the majority of the 2025 list.
Real-world examples
At home
Thomas was building a personal portfolio website and used a tutorial's code to add a contact form. A security-conscious friend pointed out the form was vulnerable to SQL injection: attacker input was being passed directly to a database query. Thomas switched to parameterized queries after reading the OWASP injection cheat sheet.
At work
The application security team at Brightfield Insurance added OWASP Top 10 scanning to their CI/CD pipeline using a SAST tool. Each pull request was automatically checked for injection patterns and outdated dependencies. This caught 14 high-severity issues before they reached production in the first month.
Common confusions
- The OWASP Top 10 is not a compliance framework and there is no OWASP Top 10 certification or audit. Organizations that claim to be 'OWASP Top 10 compliant' are using the term loosely. The list is a risk awareness and education document: a useful guide, not a standard with defined requirements and verification criteria.
- The Top 10 changes between editions and categories are not directly comparable across versions. An organization that assessed against the 2021 list needs to re-evaluate against the 2025 list, as the categories changed in scope, grouping, and ranking. Injection, for example, was A1 in 2017, A03 in 2021, and A05 in 2025, while SSRF lost its own slot and became part of Broken Access Control.
- Addressing the OWASP Top 10 does not make an application fully secure. The list covers the most prevalent risks, not all risks. Denial-of-service attacks, business logic flaws, social engineering, and supply chain compromises beyond what A03 and A08 cover are among the significant attack surfaces not captured by the current Top 10.
For analysts
In BA artefacts, OWASP Top 10 categories translate directly into security non-functional requirements and acceptance criteria. For any web-facing system, require that the architecture is reviewed against each OWASP category before development starts (catching A06 Insecure Design early) and that penetration testing explicitly tests for each category before go-live. Useful acceptance criterion: 'The application must have no critical or high severity OWASP Top 10 findings in the penetration test report before production deployment.' When writing access control requirements (A01), specify authorization logic explicitly: do not leave it to developer interpretation.
History & origin
OWASP was founded in 2001 and the first Top 10 was published in 2003 based on early web application vulnerability data. The list has been updated in 2004, 2007, 2010, 2013, 2017, and 2021, each edition reflecting shifts in the threat landscape. The 2017 edition added XML External Entities (XXE) and Insecure Deserialization. The 2021 edition reorganized categories to be more design-focused, promoting Broken Access Control to first place (found in 94% of tested applications) and adding Insecure Design and Software and Data Integrity Failures as new entries. The 2025 edition kept Broken Access Control first, added Software Supply Chain Failures and Mishandling of Exceptional Conditions, and folded Server-Side Request Forgery into Broken Access Control.